What type of attack exploits a vulnerability where an application takes user input and uses it to construct a database query without proper sanitization?